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NRS AUDIT AND RISK COMMITTEE MEETING 
09 December 2021 
MS Teams 
ARC Members 
Colin Ledlie (Chair) NRS Non-Executive Director 


Bill Matthews NRS Non-Executive Director 

Christine Martin NRS Non-Executive Director 

ARC Attendees 

Mandy Gallacher NRS Non-Executive Director- (Item 3) 
Kate Moffat Internal Auditor — Scottish Government 
Paul Lowe NRS, Chief Executive 

Linda Sinclair NRS, Director of Corporate Services & Accountable officer 
Claire Gillespie NRS, Chief Financial Officer 

Anna Krakowska NRS, Head of Strategy and Planning 
Lesley Smillie NRS, Census Director team (Item 3) 
Shirley Cameron NRS, Head of Business Management 


Graham Thomson NRS, Business Management (Secretariat) 


Apology: 

Asif Haseeb External Auditor — Audit Scotland 

Graeme Samson External Auditor — Audit Scotland 

Lorraine Twyford Internal Auditor - Scottish Government 

1. Welcome, Introductions and Apologies. Declaration of Interests & 


Matters Arising 


1.1. The Chair welcomed everyone to the meeting. Apologies were noted as 
listed. 


1.2 Bill Matthews advised of a new appointment as a Panel Member of Redress 
Scotland, there was no anticipated conflict of interest. 


2. Meeting held on 16 September 2021 
2.1 Minutes from last meeting on 16 September 2021 were approved. 
3. NRS Census 2022 


3.2 Lesley Smillie provided Committee members with an update on the 
programme status. The following topics were covered in the report: 


e The Programme Status was reported as Amber with continued focus 
resulting in good progress across the whole programme. 

e Programme governance continued to be refined and to focus on key risks, 
issues and blockers. 

e The census live operating model and governance had been agreed by the 
Executive Management Board. 

e Operational readiness critical success factors continued to be closely 
monitored through governance. 
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e Progress with communications and engagement plans was noted. A detailed 
public relations campaign had been devised to support the census campaign. 

e Assurance activity continued to be a focus. The Digital First action plan had 
been submitted to the Scottish Government Digital Assurance Office (DAO) 
following an assessment. Evidence would be provided to complete actions 
and assessment criteria identified. 

e Other assurance activity relating to the DAO Technical Assurance Framework 
(TAF) assessment continued to be managed. 


3.2 Andy Robertson provided an update on the recent TAF assessment review 
which had focused on readiness to ‘go live’ in 2022. The review had provided a 
further improved ‘Delivery Confidence Assessment’ of amber/green. It was noted 
that this was a very positive position to have reached in a programme of the scale 
and complexity of the census. The review team had noted a high level of confidence 
in the Go Live schedule. They had identified three recommendations, all noted as 
essential, with no critical recommendations. An action plan had been prepared and 
would be submitted to DAO. 


3.3 Bill Matthews asked about cyber-attack experiences in the ONS and NISRA 
2021 censuses. Paul Lowe confirmed there continued to be active sharing of 
experiences with census partners in the UK and across the world, as well as a good 
relationship with the National Cyber Security Centre (NCSC). NRS was also 
working with Police Scotland and NCSC on an ongoing basis, to identify and 
manage fraud, criminal and impersonation risks. 


3.4 Mandy Gallacher asked about Communications and Engagement activity and 
support Non-executive Directors might provide, with appropriate guidance. Lesley 
Smillie confirmed this had been considered and would be happy to provide support 
to NXDs if helpful. 


Action A02/21: Leslie Smillie to consider how NRS NXDs might be supported 
with guidance in relation to Communication and Engagement activity. Owner: 
Lesley Smillie 


3.5 Christine Martin asked about risk reporting and the status reported. Lesley 
Smillie indicated that risks were continually monitored in governance (Census Risk 
Forum) and that a review of probability and target status would happen ahead of the 
next ARC meeting. 


3.6 Activity to monitor the census budget was continuing, with the aim to achieve 
a balanced the Census budget a year end. 


4. Section 22 of the Public Finance and Accountability (Scotland) 
Act 2000 


4.1 |The Committee noted that the Auditor General for Scotland had appeared 
before the Scottish Parliament’s Public Accounts Committee (PAC) on the morning 
of 09 December 2021. This followed the publication of a section 22 report in terms of 
the Public Finance and Accountability (Scotland) Act 2000, relating to the NRS 
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annual report and accounts 2020/21. NRS had received a clean and unmodified 
opinion from the audit. The report provided an update from Audit Scotland relating to 
the delivery of the census programme. 


4.2 _ It was noted that during the evidence session there had been some factual 
inaccuracies, these would be highlighted to Audit Scotland and PAC as required. It 
was expected that NRS would also be called to attend PAC in 2022. 


5. NRS Finance Report 


5.1 Claire Gillespie provided an oral update on the finance position and mid-year 
review activity for the 2021-2022 financial year. 


5.2 Performance to date was noted as in line with forecast. A reported £1.5 million 
pressure at the start of the year was now sitting at a £0.5m pressure. Review of 
expenditure plans would continue with the aim of achieving a balanced budget at 
year end. 


5.3 A paper would be submitted for the next meeting to note the position. 
6. SG Internal Audit and Assurance reports 


6.1 Kate Moffat confirmed the 2021-2022 Audit Plan was progressing well. The 
Committee were asked to note an amendment to the plan. An audit of recruitment 
and workforce planning process would commence in quarter 4. The Committee 
noted the amendment to the plan. 


6.2 Linda Sinclair advised the Committee that the NRS Health and Safety 
Committee (H&S) had been established and the work of the committee was still 
forming. Updates from H&S would be provided to the NRS Executive Management 
Board. A permanent Health and Safety lead for NRS had been appointed. It was 
noted that an NxD, Gordon Shipley, was a member of the committee. 


6.4 Other papers provided for information were noted by the Committee. 
7. Committee Reports - To Note and Questions 


NRS Governance Report 


7.1 Linda Sinclair introduced the paper, which provided a summary of activity 
across the NRS internal systems of control. Updates on arrangements relating to 
Covid were noted. 


NRS Portfolio report 


7.2 |The Committee noted the report, which provided an update on the status of 
current NRS projects and programmes. 
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NRS Assurance update 





7.3 The Committee noted the report, which provided an update on the status of 
assurance activities since the last report presented to Audit and Risk Committee in 
September 2021. 


NRS Audit Recommendations Status Report 





7.4 Colin Ledlie asked if three outstanding actions from the 2019-20 Audit 
Scotland Report could be closed off. Linda Sinclair indicated that work was ongoing 
for one. The remainder would be reviewed with a view to closure. 


8. To Note: ARC Forward Look for year ahead 


8.1 The report was included for information and outlined proposed ARC business 
for the next twelve months. The next meeting would specifically focus on Census 
activity. 


9. AOB & Date of Next Meeting 17 February 2022, Close 


9.1 Paul Lowe provided the Committee with an update on a recent ARC NxD 
recruitment exercise. A suitable candidate had been identified and had accepted. 
Once security clearance was completed, Paul Lowe would write to advise the 
committee. 


9.2 The next meeting was planned for 17 February 2022 
End 


